Securing credentials with optical security features formed by quasi-random optical characteristics of credential substrates

ABSTRACT

Systems and methods are described for securing credentials with optical security features formed by quasi-random optical characteristics (QROCs) of credential substrates. A QROC can be a pattern of substrate element locations (SELs) on the substrate that includes some SELs that differ in optical response from surrounding SELs. During manufacturing, a QROC of a substrate can be characterized, hidden by a masking layer, and associated with a substrate identifier. During personalization, personalization data can be converted into an authentication graphic formed on the substrate by de-masking portions of the masking layer according to a de-masking pattern. The graphic formation can result in a representation that manifests a predetermined optical response only when the de-masking pattern is computed with knowledge of the hidden QROC. The authentication graphic and optical response can facilitate simple human authentication of the credential without complex or expensive detection equipment.

FIELD

Embodiments relate generally to securing credentials, and, moreparticularly, to securing credentials with optical security featuresformed by quasi-random optical characteristics of credential substrates.

BACKGROUND

Many types of credentials include one or more human-discernable, opticalsecurity features on a laminated structure. If a nefarious individualobtains credential blanks, he may attempt unauthorized personalizationof the credential by adding security features that appear authentic.Adding security features by printing, or the like, can often beperformed with relatively inexpensive and ubiquitous technologies,and/or with little specialized knowledge or skill. Some credentials coata substrate with an opaque coating, and add one or more securityfeatures by selectively causing certain regions of the opaque coating tobecome fully or partially transparent to the substrate below (e.g., byablation or some other process). If the substrate and coating are ofcontrasting colors, such a process can be used to form a two-color(e.g., half-tone) personalization image (e.g., of the credentialholder's face). Adding security features by ablation of a coating, orthe like, can often involve be more difficult that simply printing orembossing a security feature. However, many such processes can still berelatively simple to spoof (e.g., to personalize the credential in amanner that is good enough to pass visual inspection, etc.) withoutspecialized knowledge, skill, equipment, etc.

BRIEF SUMMARY

Among other things, systems and methods are described herein forsecuring credentials with optical security features formed byquasi-random optical characteristics (QROCs) of credential substrates.Embodiments operate in context of a credential substrate having a QROCthat, during manufacturing, is characterized (e.g., formed and/ormeasured), hidden by a masking layer, and associated with a credentialsubstrate identifier. The QROC can be defined according to a pattern ofsubstrate element locations (SELs) on the substrate that includes someSELs that differ in optical response from their surrounding SELs. Duringpersonalization of the credential substrate, personalization data can beconverted into a human-discernable representation of an authenticationgraphic that is formed on the substrate by de-masking portions of themasking layer according to a de-masking pattern. The graphic formationis performed in such a way that the resulting human-discernablerepresentation manifests a predetermined authentication optical responseonly (i.e., with high statistical likelihood) when the de-maskingpattern is computed with knowledge of the hidden QROC. For example,forming the image with knowledge of the QROC will yield an image withtwo colors only, while an image with three colors will likely be formedwithout knowledge of the QROC.

According to one set of embodiments, a method is provided for securing acredential using optical security features. The method includes:receiving personalization data for personalizing a substrate associatedwith an identifier; retrieving a quasi-random optical characteristic(QROC) of the substrate according to the identifier, the QROC definedaccording to a number of substrate element locations (SELs) on thesubstrate, at least a first portion of the SELs each manifesting a firstoptical response, and at least a second portion of the SELs interspersedwith the first SELs and each manifesting a second optical response thatis different from the first optical response, wherein, duringmanufacturing of the substrate, the QROC was recorded, opticallyobscured by a physical mask, and associated with the identifier;computing a de-masking pattern as a function of the personalization dataand the QROC, such that the de-masking pattern defines a revealed set ofthe SELs of the QROC and an unrevealed set of the SELs of the QROC,which together form a human-discernable representation of anauthentication graphic that manifests a predetermined authenticationoptical response; and de-masking portions of the physical mask accordingto the de-masking pattern, thereby forming the human-discernablerepresentation of the authentication graphic on the substrate.

In some such embodiments, the de-masking pattern forms thehuman-discernable representation by revealing only SELs that manifestthe first optical response, such that the predetermined authenticationoptical response corresponds to the first optical response. In othersuch embodiments, de-masking portions of the physical mask includesablating portions of the physical mask to reveal a subset of the SELsdefined according to the de-masking pattern. In other such embodiments,de-masking portions of the physical mask includes altering thetransmittance of the physical mask to at least partially reveal a subsetof the SELs defined according to the de-masking pattern.

Some such embodiments further include manufacturing the substrate by:forming the substrate; measuring the QROC over at least a region of thesubstrate; storing the measured QROC in association with the identifierto record the QROC; and obscuring the QROC by forming the physical maskover at least the region of the substrate. Other such embodimentsfurther include manufacturing the substrate by: generating a QROCpattern to be substantially unique to the substrate; forming thesubstrate to include the QROC pattern; storing the generated QROCpattern in association with the identifier to record the QROC; andobscuring the QROC by forming the physical mask over at least the regionof the substrate.

In some such embodiments, the substrate includes a surrounding materialhaving material inclusions therein, one of the surrounding material orthe material inclusions defining the first portion of the SELs, and theother of the surrounding material or the material inclusions definingthe second portion of the SELs. In other such embodiments, the substrateis formed with a first layer manifesting the first optical response anda second layer manifesting the second optical response. As oneimplementation, the first layer is formed by printing the first portionof the SELs on the second layer. As another implementation, the firstlayer is formed on the second layer, and the first layer has firstregions that define the first portion of the SELs and second regionsthat reveal underlying portions of the second layer, thereby definingthe second portion of the SELs. In some such embodiments, the firstoptical response is a first color and the second optical response is asecond color. In other such embodiments, the first optical response is afirst transmittance and the second optical response is a secondtransmittance.

In some such embodiments, the first portion of the SELs includes anumber of pixels each manifesting the first optical response. In othersuch embodiments, the first portion of the SELs includes a number ofalphanumeric characters quasi-randomly arranged on the substrate, eachcharacter manifesting the first optical response. In other suchembodiments, the first portion of the SELs includes a number ofgeometric elements quasi-randomly arranged on the substrate, eachgeometric element manifesting the first optical response. In some suchembodiments, the human-discernable representation is a half-tonerepresentation of the authentication graphic. In some such embodiments,the authentication graphic is personalized to the credential holderaccording to the received personalization data associated with thesubstrate.

According to another set of embodiments, a credential substrate isprovided. The credential substrate includes: a number of first substrateelement locations (SELs) each manifesting a first optical response; anumber of second SELs interspersed with the first SELs and eachmanifesting a second optical response that is different from the firstoptical response, wherein the SELs define a quasi-random opticalcharacteristic (QROC) of the substrate, which is recorded and associatedwith an identifier of the substrate during manufacturing of thesubstrate; and a physical mask formed over, and optically obscuring, atleast a portion of the first and second SELs, wherein a portion of thephysical mask is de-masked, according to a de-masking pattern computedas a function of the QROC and personalized data associated with acredential holder of the substrate, thereby forming, from a revealed setof the SELs, a human-discernable representation of an authenticationgraphic that manifests a predetermined authentication optical response.

In some such embodiments, the substrate includes a surrounding materialhaving material inclusions therein, one of the surrounding material orthe material inclusions defining the first portion of the SELs, and theother of the surrounding material or the material inclusions definingthe second portion of the SELs. In other such embodiments, the substrateis formed with a first layer manifesting the first optical response, anda second layer manifesting the second optical response. In oneimplementation, the first layer is formed by printing the first portionof the SELs on the second layer. In another implementation, the firstlayer is formed on the second layer, and the first layer has firstregions that define the first portion of the SELs and second regionsthat reveal underlying portions of the second layer, thereby definingthe second portion of the SELs.

In some such embodiments, the first optical response is a first colorand the second optical response is a second color. In other suchembodiments, the first optical response is a first transmittance and thesecond optical response is a second transmittance. In some suchembodiments, the first portion of the SELs includes a number of pixelseach manifesting the first optical response. In other such embodiments,the first portion of the SELs includes a number of alphanumericcharacters quasi-randomly arranged on the substrate, each charactermanifesting the first optical response. In other such embodiments, thefirst portion of the SELs includes a number of geometric elementsquasi-randomly arranged on the substrate, each geometric elementmanifesting the first optical response. In some such embodiments, thehuman-discernable representation is a half-tone representation of theauthentication graphic. In some such embodiments, the authenticationgraphic is personalized to the credential holder according to thereceived personalization data associated with the substrate.

According to another set of embodiments, a credential manufacturingsystem is provided. The system includes a personalization processor anda de-masker. The personalization processor operates to: receivepersonalization data for personalizing a substrate associated with anidentifier; retrieve a quasi-random optical characteristic (QROC)pre-associated with the identifier of the substrate, the QROC definedaccording to a number of substrate element locations (SELs) on thesubstrate, at least a first portion of the SELs each manifesting a firstoptical response, and at least a second portion of the SELs interspersedwith the first SELs and each manifesting a second optical response thatis different from the first optical response, wherein, duringmanufacturing of the substrate, the QROC was recorded, opticallyobscured by a physical mask, and associated with the identifier; andcompute a de-masking pattern as a function of the personalization dataand the QROC, such that the de-masking pattern defines a revealed set ofthe SELs of the QROC and an unrevealed set of the SELs of the QROC,which together form a human-discernable representation of anauthentication graphic that manifests a predetermined authenticationoptical response. The de-masker operates to de-mask portions of thephysical mask according to the de-masking pattern, thereby forming thehuman-discernable representation of the authentication graphic on thesubstrate.

Some such embodiments further include a substrate former, incommunication with the personalization processor, which operates to:produce the substrate to include the number of SELs that defines theQROC of the substrate; and form a physical mask over, and therebyoptically obscure, at least a portion of the first and second SELs. Somesuch embodiments further include a QROC profiler that operates to:measure the QROC of the produced substrate prior to the substrate formerforming the physical mask; and store the measured QROC in associationwith the identifier to record the QROC. In certain such embodiments, thesubstrate former further operates to generate a QROC pattern to besubstantially unique to the substrate; the substrate former operates toproduce the substrate to include the number of SELs in accordance withthe generated QROC pattern; and the credential manufacturing systemfurther includes a QROC profiler that operates to store the generatedQROC in association with the identifier to record the QROC. In some suchembodiments, the substrate former operates to produce the substrate toinclude the number of SELs by forming a layer manifesting the firstoptical response on an underlying layer of the substrate that manifeststhe second optical response. In other such embodiments, the substrateformer operates to produce the substrate to include the number of SELsby forming the substrate from a surrounding material having materialinclusions therein, one of the surrounding material or the materialinclusions defining the first portion of the SELs, and the other of thesurrounding material or the material inclusions defining the secondportion of the SELs. In some such embodiments, the substrate former isin communication with the personalization processor over a securenetwork.

In some such embodiments, the de-masker operates to ablate portions ofthe physical mask to reveal a subset of the SELs defined according tothe de-masking pattern. In other such embodiments, the de-maskeroperates to alter the transmittance of the physical mask to at leastpartially reveal a subset of the SELs defined according to thede-masking pattern. In other such embodiments, the de-masker operates toablate portions of the physical mask to reveal a subset of the SELsdefined according to the de-masking pattern. In some such embodiments,the human-discernable representation is a half-tone representation ofthe authentication graphic. In some such embodiments, the authenticationgraphic is personalized to the credential holder according to thepersonalization data received by the personalization processor.

BRIEF DESCRIPTION OF THE DRAWINGS

The present disclosure is described in conjunction with the appendedfigures:

The patent or application file contains at least one drawing executed incolor. Copies of this patent or patent application publication withcolor drawings will be provided by the Office upon request and paymentof the necessary fee.

FIG. 1 shows a block diagram of a credential production environmentincluding an illustrative credential manufacturing system, according tovarious embodiments;

FIG. 2A shows a portion of a credential manufacturing system toillustrate some implementations of a credential forming phase using asubstrate former;

FIG. 2B shows a portion of a credential manufacturing system toillustrate other implementations of a credential forming phase using asubstrate former;

FIG. 2C shows a portion of a credential manufacturing system toillustrate still other implementations of a credential forming phaseusing a substrate former;

FIG. 3 shows a portion of a credential manufacturing system toillustrate some implementations of a credential personalization phaseusing a credential personalizer, according to various embodiments;

FIG. 4 shows an example to illustrate authorized versus unauthorizedpersonalization of a credential substrate (COLOR);

FIG. 5 shows a flow diagram of an illustrative method for forming acredential that supports optical security by quasi-random opticalcharacteristics of credential substrates, according to variousembodiments;

FIG. 6 shows a flow diagram of an illustrative method for personalizinga credential in a manner that exploits quasi-random opticalcharacteristics of credential substrates, according to variousembodiments; and

FIG. 7 shows an exemplary computational environment for implementingoptical security features formed by quasi-random optical characteristicsof credential substrates, according to various embodiments.

In the appended figures, similar components and/or features may have thesame reference label. Further, various components of the same type maybe distinguished by following the reference label by a second label thatdistinguishes among the similar components. If only the first referencelabel is used in the specification, the description is applicable to anyone of the similar components having the same first reference labelirrespective of the second reference label.

DETAILED DESCRIPTION

FIG. 1 shows a block diagram of a credential production environment 100including an illustrative credential manufacturing system 110, accordingto various embodiments. Embodiments of the credential manufacturingsystem 110 include a substrate former 120 and a credential personalizer140. Various functionality and features can generally be categorized intwo phases: a credential forming phase; and a credential personalizationphase. For example, during the credential forming phase, the substrateformer 120 can process substrate stock 115 into a credential substrate125 (i.e., a non-personalized credential); and, during the credentialpersonalization phase, the credential personalizer 140 can process thecredential substrate 125 into a personalized credential 145 (i.e.,having one or more personalized security features). Embodiments caninclude components and/or functions directed to either phase, orembodiments can include components and/or functions directed to bothphases.

Many types of credentials (e.g., payment cards, identification cards,passports, etc.) are implemented with one or more human-discernable(e.g., printed, embossed, stamped, etched, etc.) optical securityfeatures on a laminated structure (e.g., a wallet card). If a nefariousindividual obtains credential blanks (i.e., formed, coated credentialsubstrates that have not yet been personalized), he may attemptunauthorized personalization of the credential by adding securityfeatures that appear authentic. Some conventional techniques for addingsecurity features are relatively simple to spoof (e.g., to personalizethe credential in a manner that is good enough to pass visualinspection, etc.). For example, adding security features by printing, orthe like, can often be performed with relatively inexpensive andubiquitous technologies (e.g., a standard printer), and/or with littlespecialized knowledge or skill (e.g., with simple visual inspection ofan authentic credential for reference).

Some other conventional techniques implement credentials with asubstrate covered by an opaque coating, and form one or more securityfeatures on the credentials by selectively causing certain regions ofthe opaque coating to become fully or partially transparent to thesubstrate below. For example, a thin metallic film or other material(e.g., a “mask”) may be applied to a substrate during manufacture of acard blank. Subsequently when the credential is being individualized,portions of the coating may be ablated, oxidized, or otherwise madetransparent to selectively reveal portions of the substrate below thecoating. If the underlying substrate is a uniform color that visuallycontrasts with the coating (e.g. white substrate and a dark coating), abinary image of some kind can be formed in this manner. For example,where a personalization image is a gray-scale image (e.g., an image ofthe credential holder's face), such a binary process can be combinedwith standard halftone processing to yield a binary image that retainsgray-scale characteristics of the original image. Adding securityfeatures by ablation of a coating, or the like, can often be moredifficult that simply printing or embossing a security feature. However,many such processes can still be relatively simple to spoof withoutspecialized knowledge, skill, equipment, etc.

Some embodiments are described herein for securing credentials withoptical security features formed by quasi-random optical characteristics(QROCs) 135 of credential substrates. As used herein, “quasi-random” isintended to broadly encompass truly random characteristics;pseudo-random characteristics; characteristics that are not random perse, but are produced with a large number of variants such that the oddsof a person guessing which of the variants a substrate contains areacceptably small; etc. As such, the QROC 135 can include any opticallydiscernable, quasi-random pattern that is formed on, embedded in,inherent to, and/or otherwise associable with a particular substrate.The QROC 135 can be defined according to a pattern of substrate elementlocations (SELs) on the substrate. For example, each SEL can be a“pixel” (e.g., formed from a single “dot” or small array of dots or oneor more colors), or any other suitable type of small, discrete location.

During the credential forming phase, embodiments of the substrate former120 can form a credential substrate 125 to have a distinct QROC 135(i.e., unique, or at least sufficiently unique to thwart unauthorizedpersonalization, as described herein). The QROC 135 can include firstSELs that manifest a first optical response (e.g., color, transmittance,etc.), and the first set of SELs can be interspersed with second SELsthat manifest a second optical response that is different from the firstoptical response. In some embodiments, the QROC 135 is the result ofrandom and uncontrollable phenomena (e.g., inherent variations in color,microstructure, etc. of the credential substrate material), therebyrepresenting a physically unclonable function (PUF).

In some embodiments, the QROC 135 is defined by inherent variations incolor, microstructure, etc. of the credential substrate material. Forexample, the substrate stock 115 can be manufactured from a materialhaving metal-fleck or other inclusions, a swirl pattern from mixedmaterials, a granular pattern from metal or other materials, deliberateor undeliberate manufacturing variation (e.g., in color, transparency,etc.), and/or the like, which is sufficiently unique to each article(e.g., each cut piece of substrate stock 115) to be useful as the QROC135. In other embodiments, the QROC 135 is produced by the substrateformer 120 in an indeterminate manner. For example, the substrate former120 can spray or splatter paint, etching solution, etc. on the substratestock 115 to produce a quasi-random pattern of optically different SELsfor use as the QROC 135. In other embodiments, the substrate former 120can produce the QROC 135 in a relatively deterministic, but stillquasi-random manner. For example, the substrate former 120 can use apredetermined function to generate a QROC pattern, which can be printedon the substrate stock 115 to form the QROC 135. In certainimplementations, the function can be seeded by a pseudorandom number, byan identifier associated with the credential substrate 125 (e.g., theCSID, as described herein), by an identifier associated with acredential holder, issuer, etc.), or in any other suitable manner. Whilesome QROC 135 implementations use the underlying substrate material asone SEL type (e.g., and one or more other SEL types are formed incontext therewith), other QROC 135 implementations can form all the SELsthat define the QROC 135. For example, a two-color QROC 135 can beformed by dispersing SELs of one color over a region of a substrate of adifferent color, so that unpainted portions of the region of thesubstrate become the second-color SELs of the QROC 135; or a region ofthe substrate can be completely covered with interspersed SELs ofdifferent colors, which together form the QROC 135 (i.e., without usingthe substrate color as part of the QROC 135 definition).

During manufacturing (during the credential forming phase), the QROC 135can be characterized and stored in association with a credentialsubstrate identifier (CSID) 137 in a QROC data store 130. For example,the QROC 135 can be treated as a bit-string, bit-array map, or otherdata map that represents an array of SELs in a defined region of thecredential substrate 125. The QROC data store 130 can include anysuitable type of storage, such as a tangible, non-transient,computer-readable storage medium, or set of storage media, that iscollocated with the substrate former 120, in communication with thesubstrate former 120, etc. The CSID 137 can be any sufficiently uniqueidentifier (e.g., alphanumeric string, binary string, image, etc.), forassociating the QROC 135 with the credential substrate 125. Someembodiments store the QROC 135 in a manner that is sufficiently secureto thwart unauthorized access, such as by encryption, digital signing,etc. For example, storing the QROC 135 can involve computing acryptographic hash as a function of the QROC 135 and the CSID 137.

The CSID 137 can be any sufficiently unique identifier (e.g.,alphanumeric string, binary string, image, etc.), for associating theQROC 135 with the credential substrate 125. For example, the credentialsubstrate 125 can be assigned a machine-readable serial number, or arepresentation of the QROC 135 (e.g., a digital signature) can be usedas the CSID 137. The CSID 137 can be accessible on the credentialsubstrate 125 itself, for example, by printing the CSID 137 on some(e.g., un-masked) portion of the credential substrate 125, by writingthe CSID 137 to an RFID chip or other feature of the credentialsubstrate 125, etc. In some embodiments, the CSID 137 is furtherobfuscated from unauthorized access, for example, by encryption,encoding, mapping to another identifier in a secure database, etc.

Having characterized the QROC 135 and stored the QROC 135 in associationwith the CSID 137 in the QROC data store 130, embodiments of thesubstrate former 120 can optically obscure the QROC 135 by forming amasking layer. In general, the masking layer produces an opticalresponse that obscures one or more of the optical responses that definethe QROC 135. In some implementations, the QROC 135 is defined by firstSELs of a first color in context of SELs of a second color (e.g., blackon white, red on white, ultraviolet on black, etc.), and the maskinglayer is a third color (e.g., black, silver, etc.). In anotherimplementation, the QROC 135 is defined by first SELs of a firsttransmittance in context of SELs of a second transmittance (e.g., opaqueon transparent, cloudy on clear, etc.), and the masking layer is a thirdtransmittance (e.g., opaque). The transmittance can be with respect toone or more particular wavelengths (e.g., SELs and/or masking can differin opacity with respect to visible light, ultraviolet or infrared light,a particular polarization of light, etc.). Other implementations caninclude combinations of color and transmittance and/or other opticalresponses (e.g., reflectance, scattering, etc.).

For the sake of added clarity, FIGS. 2A-C show examples of substrateformer 120 implementations. Turning first to FIG. 2A, a portion of acredential manufacturing system 200 a is shown to illustrate someimplementations of a credential forming phase using a substrate former120. As described with reference to FIG. 1, the substrate former 120processes substrate stock 115 into a credential substrate 125. In theillustrated implementation, the substrate former 120 includes (or is incommunication with) a QROC generator 210. The QROC generator 210 candeterministically generate a QROC pattern, which the substrate former120 can use to form the QROC 135 on the substrate stock 115 in anysuitable manner. For example, as described above, the QROC generator 210can use a predetermined function to compute a QROC pattern, which can beprinted, or otherwise incorporated with the substrate stock 115, to formthe QROC 135. Embodiments of the substrate former 120 can furtherserialize and/or otherwise identify the credential substrate 125 with asufficiently unique CSID 137. The QROC 135 can be stored in the QROCdata store 130 in association with the CSID 137. After characterizingthe QROC 135 and associating the QROC 135 with the CSID 137, thesubstrate former 120 can optically obscure the QROC 135.

While the substrate is referred to as the credential substrate 125 atvarious stages in the forming credential forming phase, the credentialsubstrate 125 generally refers to the output of the credential formingphase. In particular, the substrate stock 115 with the QROC 135optically obscured by a masking layer is generally referred to herein asthe credential substrate 125; and this credential substrate 125 isprovided to the credential personalizer 140 for adding personalizedsecurity features during the credential personalization phase. Asillustrated, the credential substrate 125 output from the substrateformer 120 can include three layers: a base layer 220, a QROC layer 223,and a masking layer 225. The base layer 220 generally refers to thesubstrate stock 115. The QROC layer 223 refers to the SELs (e.g., paintspecks, printed characters, etc.) added in context of the substratestock 115 to form the QROC 135. In some implementations, the QROC layer223 can be implemented constructively to the substrate stock 115; whilein other implementations, the QROC layer 223 can be implementeddestructively to the substrate stock 115 (e.g., by removing sublayers orother elements of the substrate stock 115). The masking layer 225includes the optically obscuring mask. In some implementations, one ormore of the “layers” includes one or more sub-layers. For example, oneimplementation of the masking layer 225 includes a first sub-layerhaving a first polarization and a second sub-layer having a second(orthogonal) polarization; such that, in any particular location, themask can be left opaque (i.e., with no layers removed), rendered fullytransparent to the underlying SELs (i.e., by removing both layers), orrendered partially transparent to the underlying SELs (i.e., transparentto a particular polarization of light by removing the orthogonallypolarized layer).

Turning to FIG. 2B, a portion of a credential manufacturing system 200 bis shown to illustrate other implementations of a credential formingphase using a substrate former 120. As described with reference to FIG.1, the substrate former 120 processes substrate stock 115 into acredential substrate 125. In the illustrated implementation, thesubstrate former 120 includes (or is in communication with) a QROCgenerator 210 (e.g., as described with respect to FIG. 2A) and a QROCprofiler 230. In such implementations, it is assumed that the QROC 135is not independently known (e.g., it was not generated by adeterministic function, or the like, as described with respect to FIG.2A). In some embodiments of FIG. 2B, the QROC generator 210 cannon-deterministically (e.g., randomly) generate a QROC pattern, whichthe substrate former 120 can use to form the QROC 135 on the substratestock 115 in any suitable manner. For example, the QROC generator 210can spray or splatter paint, etching solution, etc. on the substratestock 115 to produce a quasi-random pattern of optically different SELsfor use as the QROC 135.

Having formed the QROC 135, the QROC profiler 230 can measure the formedQROC 135 to generate a profile thereof. The profile can be any suitablerepresentation, such as an image, a set of SEL values (e.g., SELlocations with associated color, intensity, transmittance, etc.), etc.The substrate former 120 can serialize and/or otherwise identify thecredential substrate 125 with a sufficiently unique CSID 137; theprofiled (measured) QROC 135 can be stored in the QROC data store 130 inassociation with the CSID 137; and the substrate former 120 canoptically obscure the QROC 135 with a masking layer 225. As in FIG. 2A,the resulting credential substrate 125 can include a base layer 220, aQROC layer 223, and a masking layer 225.

Turning to FIG. 2C, a portion of a credential manufacturing system 200 cis shown to illustrate still other implementations of a credentialforming phase using a substrate former 120. As described with referenceto FIG. 1, the substrate former 120 processes substrate stock 115 into acredential substrate 125. In the illustrated implementation, thesubstrate former 120 includes (or is in communication with) a QROCprofiler 230 (e.g., without a QROC generator 210, in contrast to theimplementations described in FIGS. 2A and 2B). As in FIG. 2B, in suchimplementations, it is assumed that the QROC 135 is not independentlyknown (e.g., it was not generated by a deterministic function, or thelike, as described in FIG. 2A). Instead, it can be assumed that the QROC135 is defined by inherent variations in color, microstructure, etc. ofthe substrate stock 115. As in FIG. 2B, the QROC profiler 230 canmeasure the QROC 135 in any suitable manner to generate a profilethereof. The substrate former 120 can serialize and/or otherwiseidentify the credential substrate 125 with a sufficiently unique CSID137; the profiled (measured) QROC 135 can be stored in the QROC datastore 130 in association with the CSID 137; and the substrate former 120can optically obscure the QROC 135 with a masking layer 225. Because theQROC 135 is part of the substrate stock 115, the resulting credentialsubstrate 125 can include only two layers: a base/QROC layer (i.e.,having combined properties of the base layer 220 and the QROC layer223), and a masking layer 225.

Returning to FIG. 1, during the credential personalization phase, thecredential substrate 125 can be processed by the credential personalizer140 to form a personalized credential 145. The credentialpersonalization phase can be used to associate the credential substrate125 with a particular credential holder, issuer (e.g., issuing bank,organization, government agency, etc.), etc. Embodiments of thecredential personalizer 140 can receive personalization data 155 in anysuitable manner. In some implementations, the personalization data 155is retrieved from a database of credential holders, issuers, or the likethat may be in a queue or otherwise scheduled for receipt of acredential. In other implementations, the personalization data 155 isreceived from a personalization portal 150 (e.g., over a network 160).The personalization portal 150 can be implemented as software on, and/oraccessible via, a personal computer (e.g., desktop computer, mobiledevice, etc.) of a credential holder or issuer, and/or any othersuitable platform. For example, the personalization portal 150 can be aweb portal hosted on one or more web servers and accessible via one ormore public or private networks. The personalization data 155 caninclude any suitable information for personalizing the credential. Somepersonalization data 155 can include information specific to thecredential holder, such as a facial image, fingerprint, geneticinformation, signature, passphrase, etc. Other personalization data 155can include information specific to a particular issuer, shared by allmembers of a particular group, etc., such as a predetermined logo,image, phrase, alphanumeric string, etc.

During personalization of the credential substrate 125, personalizationdata 155 can be converted into a human-discernable representation of anauthentication graphic that is formed on the credential substrate 125 byde-masking portions of the masking layer 225 according to a de-maskingpattern. The graphic formation is performed in such a way that theresulting human-discernable representation manifests a predeterminedauthentication optical response only when the de-masking pattern iscomputed with knowledge of the hidden QROC 135 (i.e., it isstatistically highly unlikely to produce the predeterminedauthentication optical response without knowledge of the QROC 135). Forexample, forming the image with knowledge of the QROC 135 will yield animage with two colors only, while an image with three colors will likelybe formed without knowledge of the QROC 135. In some implementations,any difference in optical response from the predetermined authenticationoptical response can be easily detected by unaided visual inspection(e.g., by a human without special equipment, or with simple, inexpensiveoptics, etc.).

For added clarity, FIG. 3 shows a portion of a credential manufacturingsystem 300 to illustrate some implementations of a credentialpersonalization phase using a credential personalizer 140, according tovarious embodiments. As described with reference to FIG. 1, thecredential personalizer 140 processes a credential substrate 125 into apersonalized credential 145. As illustrated, some embodiments of thecredential personalizer 140 include (or are in communication with) apattern processor 310 and a de-masker 320.

Embodiments of the pattern processor 310 can retrieve personalizationdata 155 in any suitable manner, as described above. Embodiments of thepattern processor 310 can further retrieve the QROC 135 associated withthe credential substrate 125 in accordance with its CSID 137. Forexample, the CSID 137 can be printed on the credential substrate 125,stored in an RFID chip or other storage element of the credentialsubstrate 125, and/or otherwise accessible by the pattern processor 310directly or indirectly from the credential substrate 125 itself. Someembodiments query the QROC data store 130 (e.g., shown for context)using the CSID 137 to retrieve the QROC 135.

Using the retrieved personalization data 155 and QROC 135, the patternprocessor 310 can compute a de-masking pattern 315. The de-maskingpattern 315 is computed so as to define a revealed set of the SELs ofthe QROC 135 and an unrevealed set of the SELs of the QROC 135, whichtogether form a human-discernable representation of an authenticationgraphic that manifests a predetermined authentication optical response.For example, locations of the masking layer 225 can be mapped to SELs ofthe underlying (obscured) QROC layer 223, and the de-masking pattern 315can define which of the QROC layer 223 SELs to reveal (partially orfully) to form the desired authentication graphic with the desiredoptical response by “de-masking” corresponding masking layer 225locations. As used herein, de-masking can include any suitable manner ofpartially or fully revealing selected SELs underlying the masking layer225. For example, lasers, chemicals, etc. can be used to ablate, etch,and/or otherwise affect the obscuring properties of the mask.Determining which locations of the masking layer 225 to de-mask and inwhat manner and to what degree can involve computing the de-maskingpattern 315 to produce both the desired authentication graphic (e.g.,any suitable image, string of characters, pattern, etc., formed from, oras a function of, the personalization data 155) and to produce thedesired authentication optical response. As described above, the QROC135 is defined and obscured in such a way that de-masking the maskinglayer 225 without knowledge of the QROC 135 is highly likely to producean optical response that is easily discernable from the predeterminedauthentication optical response. For example, a half-toning algorithmcan be modified to produce a representation of the authenticationgraphic that uses only particular SELs in accordance with the QROC 135to produce the authentication optical response.

Embodiments of the de-masker 320 can de-mask portions of the maskinglayer 225 according to the de-masking pattern 315, thereby forming thehuman-discernable representation of the authentication graphic on thesubstrate in a manner that manifests the predetermined authenticationoptical response. In some embodiments, the de-masking pattern 315 formsthe human-discernable representation by revealing only SELs in the QROClayer 223 that manifest the first optical response (e.g., by ablating orotherwise removing those locations of the masking layer 225, by makingtransparent, or otherwise altering the transmittance of those locationsof the masking layer 225, etc.), and the predetermined authenticationoptical response corresponds to the first optical response. For example,suppose the base layer 220 is white and the QROC layer 223 includesdispersed red pixels, such that the base layer 220 and the QROC layer223 together manifest a quasi-random, two-color (red and white) patternof pixels (i.e., the QROC 135). De-masking with knowledge of the QROC135 can produce an authentication graphic that is only red or onlywhite; while de-masking without knowledge of the QROC 135 is likely toproduce an image with red and white pixels.

Many implementations are possible for de-masking in a manner thatproduces both the desired authentication graphic and the desiredauthentication optical response. For example, the red-whiteimplementation can be altered to use any combination of visible colors,non-visible colors (e.g., ultraviolet), transmittance (e.g., opaque,cloudy, translucent, clear, etc.), etc. Further, while each SEL in someimplementations can be a “dot” or other small, discrete region having aparticular color; each SEL in some other implementations can include oneor more alphanumeric characters, geometric features (e.g., curved lines,shapes, logos, etc.), arrays of microdots, glyphs, etc. Further, whilethe types of implementations described above can generally effectivelymanifest a three-color (or three-optical response) effect (i.e., atwo-response QROC 135 with a third-response masking layer 225), themasking layer 225 can alternatively manifest substantially the sameoptical response as one of the SEL types that makes up the QROC 135,thereby manifesting a two-response effect.

Some other implementations manifest more complex and/or higher-ordereffects (e.g., more than three optical responses). In some suchimplementations, each SEL can include an array of sub-SELs having arepeating, quasi-random, or other pattern, each having multiple colors,greyscale levels, levels of transmittance, levels of reflectivity, etc.In one such implementation, each SEL can be a pixel comprised of red,green, and blue sub-pixels (e.g., according to a Bayer pattern, as anR-G-B triple, etc.). In another similar implementation, relativelocations of the red, green, and blue sub-pixels can be unordered orrandomized in some way, and those relative locations can becharacterized as part of the QROC 135. In either implementation, thede-masking pattern 315 can define locations of the masking layer 225 tode-mask in accordance with the sub-pixels, so that the de-masking canreveal a multi-color authentication graphic, such as a full-color image,an image manifesting a macro color pattern (e.g., a color gradientacross the image), etc. For example, unauthorized personalization islikely to result in a muddy color appearance, an absence of a definedcolor pattern, etc.

Characteristics of the QROC 135, the masking layer 225, the de-maskingprocess, etc. can impact the techniques available for authentication.Some implementations produce an authentication graphic that manifests anauthentication optical response that is easily discernable by a humanwithout any additional apparatus. For example, presence or absence ofparticular colors, color patterns, transmittance, etc. can be easilydetected by an unaided human eye in typical ambient lighting conditions.Other implementations produce an authentication graphic that manifestsan authentication optical response that is easily discernable by ahuman, but only with additional apparatus. For example, special opticscan reveal presence or absence of ultraviolet or infrared features orpatterns, particular polarization effects, etc. Further, someauthentication can involve additional factors. For example, thepersonalized credential 145 can include one or more security featuresadded to the credential by other processes (e.g., by printing,embossing, engraving, storing on-board, etc.) that can be compared orcontrasted with the authentication graphic and/or its manifestedauthentication optical response.

FIG. 4 shows an example to illustrate authorized versus unauthorizedpersonalization of a credential substrate 125 (i.e., formation of anauthentication graphic with and without knowledge of a QROC 135associated with the credential substrate 125, respectively). Theillustrated example computes a de-masking pattern 315 as a function of aQROC 135 and a personalization image. The QROC 135 is a two-color (redand white) pattern of 512-by-512 pixels (i.e., SELs), where twentypercent of the pixels are red. The personalization image is a512-by-512-pixel greyscale facial image (e.g., retrieved as part of, orin accordance with, personalization data 155). As described above, it isassumed that the QROC 135 is characterized and obscured during thecredential forming phase of manufacture, such that the red SEL locationsare stored in association with a CSID 137 of the credential substrate125.

Credential personalizer 140 a is illustrated as having knowledge of theQROC 135. For example, credential personalizer 140 a can read the CSID137 from the credential substrate 125 and query the QROC data store 130to retrieve the stored QROC 135 characterization. Credentialpersonalizer 140 a can apply its knowledge of the QROC 135 to ahalf-toning algorithm to generate a de-masking pattern 315, which it canuse to de-mask locations of the masking layer 225 to generate anauthentication graphic 410 a in a manner that avoids all the red SELsdefined as part of the QROC 135. As shown, the resulting authenticationgraphic 410 a is a halftone image formed with only black and whitepixels (i.e., no red is visible).

In contrast, credential personalizer 140 b is illustrated as having noknowledge of the QROC 135 (e.g., it has access only to thepersonalization image as an unauthorized personalizer). Withoutknowledge of the QROC 135, credential personalizer 140 b can use ahalf-toning algorithm to generate a de-masking pattern 315, which it canuse to de-mask locations of the masking layer 225 to generate anauthentication graphic 410 b. However, as shown, the resultingauthentication graphic 410 b includes a large number of visible redpixels, which is easily discernable as different from the desiredauthentication optical response.

FIG. 5 shows a flow diagram of an illustrative method 500 for forming acredential that supports optical security by quasi-random opticalcharacteristics of credential substrates, according to variousembodiments. Embodiments of the method 500 begin at stage 504 byreceiving substrate stock. A credential blank can be formed from thesubstrate stock at stage 508. For example, forming the blank can includecutting the stock, etc. Embodiments can proceed by characterizing aquasi-random optical characteristic (QROC) of the credential substrate,which can be performed in various manners. For example, the QROC isdefined according to substrate element locations (SELs) on thesubstrate, at least a first portion of the SELs each manifesting a firstoptical response, and at least a second portion of the SELs interspersedwith the first SELs and each manifesting a second optical response thatis different from the first optical response.

In some embodiments, at stage 512, the QROC can be measured over atleast a region of the credential substrate. For example, the QROC can bea characteristic of the substrate, such that characterizing of the QROCinvolves recording that characteristic pattern. In other embodiments, atstage 516, the QROC can be generated to be substantially unique to thecredential substrate, and the generated QROC can be applied to thesubstrate at stage 520. In some such implementations, the QROC isgenerated in a manner that it is effectively pre-characterized so thatno measurement is needed. In other such implementations, the QROC isgenerated in a manner that is unpredictable or otherwise unknown withoutmeasuring the physical result formed in stage 520. Accordingly, afterthe forming at stage 520, some implementations measure the QROC at 512,as described above.

At stage 524, embodiments can store the characterized QROC in accordancewith a credential substrate identifier (CSID). Some implementations ofstage 524 include serializing the credential substrate, the QROC, etc.,or using any other suitable technique, to generate the CSID. At stage528, embodiments can form a masking layer on the credential substrate ina manner that optically obscures the QROC.

FIG. 6 shows a flow diagram of an illustrative method 600 forpersonalizing a credential in a manner that exploits quasi-randomoptical characteristics of credential substrates, according to variousembodiments. Embodiments of the method 600 begin at stage 604 byreceiving personalization data for personalizing a substrate associatedwith an identifier (e.g., a CSID). At stage 608, embodiments canretrieve a quasi-random optical characteristic (QROC) of the substrateaccording to the identifier. As described above, the QROC can be definedaccording to substrate element locations (SELs) on the substrate, atleast a first portion of the SELs each manifesting a first opticalresponse, and at least a second portion of the SELs interspersed withthe first SELs and each manifesting a second optical response that isdifferent from the first optical response. As described above, it can beassumed that the QROC was recorded, optically obscured by a physicalmask, and associated with the identifier during manufacturing (forming)of the substrate. In some embodiments, retrieving the QROC can involveretrieving the identifier from the credential.

At stage 612, a de-masking pattern can be computed as a function of thepersonalization data (received at stage 604) and the QROC (retrieved atstage 608). The de-masking pattern can define a revealed set of the SELsof the QROC and an unrevealed set of the SELs of the QROC, whichtogether form a human-discernable representation of an authenticationgraphic that manifests a predetermined authentication optical response.In some implementations, the de-masking pattern can define whichportions of the mask to “de-mask,” to what extent, etc. At stage 620,embodiments can de-mask portions of the physical mask according to thede-masking pattern, thereby forming the human-discernable representationof the authentication graphic on the substrate.

The methods of FIGS. 5 and 6 can be implemented using any of the systemsdescribed with reference to FIGS. 1-3 and/or other systemimplementations; and the systems described with reference to FIGS. 1-3can implement methods other than those described with reference to FIGS.5 and 6. Some of the functions of the methods and systems describedherein can be implemented in one or more computational environments.FIG. 7 shows an exemplary computational environment 700 for implementingoptical security features formed by quasi-random optical characteristicsof credential substrates, according to various embodiments. Thecomputational environment 700 can be implemented as or embodied insingle or distributed computer systems, or in any other useful way. Thecomputational environment 700 is shown including hardware elements thatmay be electrically coupled via a bus 755.

The hardware elements may include one or more central processing units(CPUs) and/or other processor(s) 705. Implementations can also includeone or more input/output devices 710, which can include and or beintegrated with a physical substrate interface 715. For example, thephysical substrate interface 715 can receive and/or physically processsubstrate stock 115, credential substrates 125, personalized credentials145, etc. Some implementations also include a power subsystem 707,including any suitable power storage, power electronics, powerinterfaces, etc. Some implementations can permit data to be exchanged,via a communications subsystem 780, with one or more networks (e.g.,with a personalization portal 150 via network 160) and/or any othercomputer or external system. The communications subsystem 780 caninclude a modem, a network card (wireless or wired), an infraredcommunication device, and/or any other suitable components orcombinations thereof.

The computational environment 700 can also include one or more storagedevices 720. By way of example, storage device(s) 720 may be diskdrives, optical storage devices, solid-state storage device such as arandom access memory (RAM) and/or a read-only memory (ROM), which can beprogrammable, flash-updateable and/or the like. The computationalenvironment 700 can additionally include a computer-readable storagemedia reader 725 a, and working memory 740, which may include RAM andROM devices as described above. The computer-readable storage mediareader 725 a can further be connected to a computer-readable storagemedium 725 b, together (and, optionally, in combination with storagedevice(s) 720) comprehensively representing remote, local, fixed, and/orremovable storage devices plus storage media for temporarily and/or morepermanently containing computer-readable information. The storagedevice(s) 720, computer-readable storage media and media reader 725,and/or working memory 740 can be used to implement the QROC data store130. In some embodiments, the computational environment 700 can alsoinclude a processing acceleration unit 735, which can include a DSP, aspecial-purpose processor and/or the like.

The computational environment 700 may also include software elements,shown as being currently located within a working memory 740, includingan operating system 745 and/or other code 750, such as an applicationprogram (which may be a client application, web browser, mid-tierapplication, etc.). For example, embodiments can be implemented asinstructions, which, when executed by one or more processors 705, causethe processors 705 to perform certain functions. Such functions caninclude functionality of the substrate former 120 and/or the credentialpersonalizer 140, for example, as described above.

A software module can be a single instruction, or many instructions, andcan be distributed over several different code segments, among differentprograms, and across multiple storage media. Thus, a computer programproduct may perform operations presented herein. For example, such acomputer program product may be a computer readable tangible mediumhaving instructions tangibly stored (and/or encoded) thereon, theinstructions being executable by one or more processors to perform theoperations described herein. The computer program product may includepackaging material. Software or instructions may also be transmittedover a transmission medium. For example, software may be transmittedfrom a website, server, or other remote source using a transmissionmedium such as a coaxial cable, fiber optic cable, twisted pair, digitalsubscriber line (DSL), or wireless technology such as infrared, radio,or microwave.

Alternate embodiments of a computational environment 700 may havenumerous variations from that described above. For example, customizedhardware might also be used and/or particular elements might beimplemented in hardware, software (including portable software, such asapplets), or both. Further, connection to other computing devices suchas network input/output devices may be employed. Software of thecomputational environment 700 may include code 750 for implementingembodiments of the present invention as described herein. For example,while not shown as part of the working memory 740, certain functionalityof other subsystems can be implemented with any suitable combination ofhardware and software, including using code 750 stored in the workingmemory 740.

Various changes, substitutions, and alterations to the techniquesdescribed herein can be made without departing from the technology ofthe teachings as defined by the appended claims. Moreover, the scope ofthe disclosure and claims is not limited to the particular aspects ofthe process, machine, manufacture, composition of matter, means,methods, and actions described above. Processes, machines, manufacture,compositions of matter, means, methods, or actions, presently existingor later to be developed, that perform substantially the same functionor achieve substantially the same result as the corresponding aspectsdescribed herein may be utilized. Accordingly, the appended claimsinclude within their scope such processes, machines, manufacture,compositions of matter, means, methods, or actions.

What is claimed is:
 1. A method for securing a credential using opticalsecurity features, the method comprising: receiving personalization datafor personalizing a substrate associated with an identifier; retrievinga quasi-random optical characteristic (QROC) of the substrate accordingto the identifier, the QROC defined according to a plurality ofsubstrate element locations (SELs) on the substrate, at least a firstportion of the SELs each manifesting a first optical response, and atleast a second portion of the SELs interspersed with the first SELs andeach manifesting a second optical response that is different from thefirst optical response, wherein, during manufacturing of the substrate,the QROC was recorded, optically obscured by a physical mask, andassociated with the identifier; computing a de-masking pattern as afunction of the personalization data and the QROC, such that thede-masking pattern defines a revealed set of the SELs of the QROC and anunrevealed set of the SELs of the QROC, which together form ahuman-discernable representation of an authentication graphic thatmanifests a predetermined authentication optical response; andde-masking portions of the physical mask according to the de-maskingpattern, thereby forming the human-discernable representation of theauthentication graphic on the substrate.
 2. The method of claim 1,wherein the de-masking pattern forms the human-discernablerepresentation by revealing only SELs that manifest the first opticalresponse, such that the predetermined authentication optical responsecorresponds to the first optical response.
 3. The method of claim 1,wherein de-masking portions of the physical mask comprises ablatingportions of the physical mask to reveal a subset of the SELs definedaccording to the de-masking pattern.
 4. The method of claim 1, whereinde-masking portions of the physical mask comprises altering thetransmittance of the physical mask to at least partially reveal a subsetof the SELs defined according to the de-masking pattern.
 5. The methodof claim 1, further comprising: manufacturing the substrate comprising:forming the substrate; measuring the QROC over at least a region of thesubstrate; storing the measured QROC in association with the identifierto record the QROC; and obscuring the QROC by forming the physical maskover at least the region of the substrate.
 6. The method of claim 1,further comprising: manufacturing the substrate comprising: generating aQROC pattern to be substantially unique to the substrate; forming thesubstrate to comprise the QROC pattern; storing the generated QROCpattern in association with the identifier to record the QROC; andobscuring the QROC by forming the physical mask over at least the regionof the substrate.
 7. The method of claim 1, wherein the substratecomprises a surrounding material having material inclusions therein, oneof the surrounding material or the material inclusions defining thefirst portion of the SELs, and the other of the surrounding material orthe material inclusions defining the second portion of the SELs.
 8. Themethod of claim 1, wherein the substrate is formed with a first layermanifesting the first optical response, and a second layer manifestingthe second optical response.
 9. The method of claim 8, wherein the firstlayer is formed by printing the plurality of first portion of the SELson the second layer.
 10. The method of claim 8, wherein the first layeris formed on the second layer, and the first layer has first regionsthat define the first portion of the SELs and second regions that revealunderlying portions of the second layer, thereby defining the secondportion of the SELs.
 11. The method of claim 1, wherein the firstoptical response is a first color and the second optical response is asecond color.
 12. The method of claim 1, wherein the first opticalresponse is a first transmittance and the second optical response is asecond transmittance.
 13. The method of claim 1, wherein the firstportion of the SELs comprises a plurality of pixels each manifesting thefirst optical response.
 14. The method of claim 1, wherein the firstportion of the SELs comprises a plurality of alphanumeric charactersquasi-randomly arranged on the substrate, each character manifesting thefirst optical response.
 15. The method of claim 1, wherein the firstportion of the SELs comprises a plurality of geometric elementsquasi-randomly arranged on the substrate, each geometric elementmanifesting the first optical response.
 16. The method of claim 1,wherein the human-discernable representation is a half-tonerepresentation of the authentication graphic.
 17. The method of claim 1,wherein the authentication graphic is personalized to the credentialholder according to the received personalization data associated withthe substrate.
 18. A credential substrate comprising: a plurality offirst substrate element locations (SELs) each manifesting a firstoptical response; a plurality of second SELs interspersed with the firstSELs and each manifesting a second optical response that is differentfrom the first optical response, wherein the SELs define a quasi-randomoptical characteristic (QROC) of the substrate, which is recorded andassociated with an identifier of the substrate during manufacturing ofthe substrate; and a physical mask formed over, and optically obscuring,at least a portion of the first and second SELs, wherein a portion ofthe physical mask is de-masked, according to a de-masking patterncomputed as a function of the QROC and personalized data associated witha credential holder of the substrate, thereby forming, from a revealedset of the SELs, a human-discernable representation of an authenticationgraphic that manifests a predetermined authentication optical response.19. A credential manufacturing system, the system comprising: apersonalization processor that operates to: receive personalization datafor personalizing a substrate associated with an identifier; retrieve aquasi-random optical characteristic (QROC) pre-associated with theidentifier of the substrate, the QROC defined according to a pluralityof substrate element locations (SELs) on the substrate, at least a firstportion of the SELs each manifesting a first optical response, and atleast a second portion of the SELs interspersed with the first SELs andeach manifesting a second optical response that is different from thefirst optical response, wherein, during manufacturing of the substrate,the QROC was recorded, optically obscured by a physical mask, andassociated with the identifier; and compute a de-masking pattern as afunction of the personalization data and the QROC, such that thede-masking pattern defines a revealed set of the SELs of the QROC and anunrevealed set of the SELs of the QROC, which together form ahuman-discernable representation of an authentication graphic thatmanifests a predetermined authentication optical response; and ade-masker that operates to de-mask portions of the physical maskaccording to the de-masking pattern, thereby forming thehuman-discernable representation of the authentication graphic on thesubstrate.
 20. The credential manufacturing system of claim 19, furthercomprising: a substrate former, in communication with thepersonalization processor, that operates to: produce the substrate tocomprise the plurality of SELs that defines the QROC of the substrate;and form a physical mask over, and thereby optically obscure, at least aportion of the first and second SELs.